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DHS/CBP Procedures for Access, Correction or Rectification, and Redress for Passenger 
Name Records (PNR)! 


1. How can an individual request access to his or her PNR? 


Any individual, regardless of citizenship, who wishes to seek access to his or her PNR held by 
DHS can do so under the Freedom of Information Act (FOIA). FOIA provides members of the 
public with access to records, subject to certain exemptions, about the operations and activities of 
the U.S. federal government. Individuals seeking access to PNR records may submit a FOIA 
request to U.S. Customs and Border Protection (CBP) using the FOIAonline Request Form, or 
by mailing a request to: 


CBP FOIA Headquarters Office 

U.S. Customs and Border Protection 

FOIA Division 

1300 Pennsylvania Avenue, NW, Room 3.3D 
Washington, DC 20229 


An individual who is not satisfied with the agency’s response under FOIA may challenge a 
refusal to disclose data or a lack of a response to a FOIA request first through an administrative 
appeals process, and then in federal court. 


2. How can an individual request correction or rectification of his or her PNR? 


Several options are available for individuals seeking correction of personally identifiable 
information (PII) held by DHS. 


e Any individual, regardless of citizenship who wishes to seek access to his or her PNR held 
by DHS can do so under the Freedom of Information Act (FOIA). FOIA provides members 
of the public with access to records, subject to certain exemptions, about the operations and 
activities of the U.S. federal government. Individuals seeking access to PNR records may 
submit a FOIA request using the FOJAonline Request Form, or by mailing a request to: 


CBP FOIA Headquarters Office 
U.S. Customs and Border Protection 
FOIA Division 


1 Article 10, paragraph 2 of the 2011 Agreement between the United States of America and the European Union on 
the Use and Transfer of Passenger Name Records to the United States Department of Homeland Security states, 
“DHS shall publish and provide to the EU for possible publication its procedures and modalities regarding access, 
correction or rectification, and redress procedures.” 
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The Privacy Act of 1974, as amended (5 U.S.C. § 552a), governs the maintenance of information 
in federal agency systems through which records are retrieved using the PII of United States 
citizens and lawful permanent residents. The Privacy Act regulates how the government can 
disclose, share, provide access to, and maintain the personal information that it collects in such 
systems. Though the Privacy Act does not afford coverage to non-U.S. persons, the Judicial 
Redress Act of 2015 (5 U.S.C. § 552a note) extends provisions of the Privacy Act to non-U.S. 
citizens and non-lawful permanent residents who are citizens of countries that have been 
designated pursuant to procedures identified within the Judicial Redress Act.* For those covered 
by neither, DHS policy? covers information for all persons, regardless of immigration status, and 
treated consistent with the Fair Information Practice Principles 

(FIPPs). DHS allows persons, including foreign nationals, to seek access and request 
amendment to certain information maintained in the Automated Targeting System‘ (ATS), 
including PNR. However, certain information maintained in ATS, such as information 
pertaining to the rule sets or accounting of a sharing with a law enforcement or intelligence entity 
in conformance with a routine use, may not be accessed, pursuant to 5 U.S.C. §§ 552a (j)(2) or 


(k)(2). 


Requests for access to personally identifiable information contained in ATS, including PNR, 
may be submitted to the FOIA Headquarters Office, above. Requests for amendment of 
information should conform to the requirements of 6 CFR Part 5, which provides the rules for 
requesting access to records maintained by DHS. The envelope and letter should be clearly 
marked “Privacy Act Access Request.” The request should include a general description of the 
records sought and must include the requester’s full name, current address, and date and place of 
birth. The request must be signed and either notarized or submitted under penalty of perjury. 


e Questions, concerns, or comments of a general or specific nature regarding CBP or its 
handling of PNR may be directed to the CBP INFO Center. You may contact the CBP INFO 
Center in any one of three ways: 


Online - https://help.cbp.gov/app/home 





Telephone - During the hours of 8:30 a.m. to 5:00 p.m. Eastern Standard Time: 
(877) 227-5511 (toll-free call for U.S. callers) 
(202) 325-8000 (international callers) 
(866) 880-6582 (TDD) 





? Available at https://www.congress.gov/114/plaws/publ126/PLA W-114publ126. pdf. 

3 Privacy Policy Guidance Memorandum 2017-01, DHS Privacy Policy Regarding Collection, Use, Retention, and 
Dissemination of Personally Identifiable Information available at https://www.dhs.gov/publication/dhs-privacy- 
policy-guidance-memorandum-2017-01. 

4 See DHS/CBP/PIA-006 Automated Targeting System, available at https://www.dhs.gov/publication/automated- 


targeting-system-ats-update. 








Mail - U.S. Customs & Border Protection 
OPA/CBP INFO Center 
1300 Pennsylvania Avenue N.W., MS: 1345 
Washington, DC 20229 


Individuals may also seek redress through the DHS Traveler Redress Inquiry Program (DHS 
TRIP). Persons who believe they have been improperly denied entry, refused boarding for 
transportation, or identified for additional inspection by CBP may submit a redress request 
through DHS TRIP. DHS TRIP is a single point of contact for persons who have inquiries or 
seek resolution regarding difficulties they experienced during their travel screening at 
transportation hubs — such as airports, seaports, and train stations — or crossing U.S. borders. 
Through DHS TRIP, a traveler can request correction of erroneous data stored in ATS and 
other data stored in other DHS databases through one application. DHS TRIP redress 
requests can be made online at http://www.dhs.gov/dhs-trip or by mail at: 





DHS Traveler Redress Inquiry Program (DHS TRIP) 
601 South 12th Street, TSA-901 
Arlington, VA 20598-6901 


In the event that a complaint cannot be resolved by CBP or through the DHS TRIP process, 
the complaint may be directed, in writing, to the Chief Privacy Officer, Department of 
Homeland Security, Washington, DC 20528-0550; Email at privacy@hg.dhs.gov; Phone: 
(202) 343-1717; and Fax: (202) 343-4010. The Chief Privacy Officer shall review the 
situation and endeavor to resolve the complaint. 





3. What are an individual’s other options for judicial redress ? 


Judicial redress for individuals, regardless of citizenship, may be available under the following 
circumstances: 


e The Computer Fraud and Abuse Act (CFAA) (18 U.S.C. § 1030) allows individuals to 
bring a civil action in court for actual damages, and in some cases punitive damages plus 
attorney fees, when that individual’s personal information held on a U.S. government 
computer system, including the Automated Targeting System (ATS) that holds PNR, has 
been improperly accessed, causing a certain type of harm. 

e The Electronic Communications Privacy Act (18 U.S.C. § 2701 et seq. and 18 U.S.C. § 
2510 et seq.) allows any person to bring a civil action in court for actual damages, and in 
some cases punitive damages plus attorney fees, when that person’s stored wire or 
electronic communications are improperly accessed or disclosed, or when that person’s 
wire, oral, or electronic communications are improperly intercepted or disclosed. 

e Under 49 U.S.C. § 46110, an individual with interest in particular transportation orders, 
including orders that implement DHS Transportation Security Administration watchlists, 
may file a petition for review in an appropriate U.S. Court of Appeals. 

e The Administrative Procedure Act (5 U.S.C. §§ 551 — 559), or APA, generally provides 
for judicial review of final agency action that is not precluded by statute or committed to 
the discretion of the agency, and provides for a court to set aside final administrative 


action not in compliance with statutes, or that is arbitrary and capricious, or an abuse of 
discretion. Individuals can bring APA claims on their own behalf, or as part of a class 
action. 


4. What administrative, civil, and criminal enforcement measures apply to PNR? 


Administrative, civil, and criminal enforcement measures are available under U.S. law for 
unauthorized disclosure of U.S. records, including PNR. Relevant provisions include, but are not 
limited to: 

e 18 U.S.C. § 641 (public money, property or records) establishes penalties for the theft or 
improper use of (among other things) any record of the United States or any department 
or agency thereof. 

e 18 U.S.C. § 1030 (fraud and related activity in connection with computers [CFAA]) 
establishes penalties related to unauthorized access to a computer system containing 
sensitive records, and the fraudulent use or damage of such systems and records. 

e 19C.F.R. § 103.34 (sanctions for improper actions by CBP officers or employees) 
establishes disciplinary actions and criminal penalties for CBP officers or employees who 
improperly disclose confidential information. 


